COPYING DATA FROM CELLEBRITE HTML FILES

Transcription

1 COPYING DATA FROM CELLEBRITE HTML FILES Some law enforcement agencies deploy their Cellebrite UFED in the field for targeted operations such as probation searches and search warrants. Using the cigarette lighter adapter and a USB thumb drive, law enforcement officers are able to quickly extract the data from a cellular phone. Unfortunately, the resulting files created by the UFED in this situation are created in a HTML format. If you have ever tried extracting data from an HTML you know it is a time consuming and frustrating process involving a lot of cutting and pasting. PMPenlink solves the problem for you. The PMPenlink.xlsm file was created by Criminal Intelligence Analyst TSgt. Matt Adams with the Iowa Department of Public Safety. He has generously made the file available to the law enforcement community. PMPenlink is a Microsoft Excel spreadsheet designed to take the data fields from a UFED generated HTML file and separate the information into separate worksheets so it can be loaded into intelligence analysis software such as PenLink, i2 Analyst Notebook, and THREADS. To use the spreadsheet open the UFED generated file in Google Chrome. This is an important step-you must use Chrome. The spreadsheet will not work correctly if you open the HTML file in any other browser. If you do not have Chrome you can download it for free from Google (provided your agency s IT department has given you Administrator rights to the computer.)

2 If Chrome is not your default browser, right click on the file and select Open with. Navigate to and select Google Chrome. Once the UFED generated HTML report is open highlight all of the data using Ctrl (Control) and the A button and copy it by pressing Ctrl and C.

3 Open the PMPenlink file. Make sure you are on the first page of the workbook. The tab is at the bottom of the screen and is labelled New. Place your cursor in the A1 cell of the New worksheet and press Ctrl and the V button. Before the data is parsed into separate worksheets you will be prompted to enter data about the case. There is only one screen that is mandatory and it is the suspect s name or the number of the phone the report was generated from. You may choose to skip some of the fields but these screens are helpful for formatting data to be uploaded into a database.

4

5 This is the only mandatory field. You must put something. Hitting Ok, or Cancel, or the X will not work. If you don t know or don t want to put your suspect s name in the file simple put in the phone number from the device or Unknown. Once you ve entered the data in the fields you will note there are new worksheets added to the bottom of the workbook. If you entered a suspect s name you will see the name in the tabs. For this example I put Unknown.

6 Each field of recovered data from the UFED will have its own tab and the information from the HTML report will populate the fields. For example, the Contacts from the report will be displayed in the first tab with the suspect s name. Multiple data fields are supported so if there are several phone numbers for a particular contact each number will be in its own column labelled Phone, Phone2, Phone3, etc. Similarly, SMS text messages will display the other number, any associated name from the contact list, the date and time, the status of the message, which folder the message was contained in, the direction of the message, and the message content.

7 Call logs are also separated by direction, the other number, associated name from the contract list, date and time, and duration. As noted in the opening, this spreadsheet was developed by Criminal Intelligence Analyst TSgt. Matt Adams with the Iowa Department of Public Safety. He can be reached at